Comparing natural baselines across corruption types.
We compare \(\ell _2\)  adversarial training with a few simple baselines: standard training, gradient regularization [1]}, and standard Gaussian data augmentation. To ensure a fair comparison, we perform a grid search for each method over the perturbation radius \(\operatorname{\mathbf {\varepsilon }}\) , regularization parameter \(\lambda \) , and noise standard deviation \(\sigma \)  respectively.
We choose to compare to gradient regularization since it is an established regularization method that may have a similar effect to adversarial training with small perturbations [2]}.
We aggregate the corruptions over each type (blurs, digital, noise, weather) and plot the results in Fig. REF  and report results over each corruption in Fig. REF  in the Appendix.
